SY0-701 Question 326
Single answerImplementation of secure protocols: Protocol selection , Port selection , Transport methodA company is deploying a new remote administration solution for Linux servers in a segmented data center. The security team wants encrypted command-line access for administrators over an untrusted internal network and wants firewall rules to permit only the required traffic. Which configuration BEST meets these requirements?
- A
Allow Telnet over TCP port 23 because it provides reliable terminal sessions with low overhead
- B
Allow SSH over TCP port 22 because it provides encrypted remote administration and uses a reliable transport
- C
Allow SFTP over UDP port 22 because it encrypts file transfers and supports interactive shell access
- D
Allow SNMPv3 over UDP port 161 because it is encrypted and can be used for secure server administration
Show answer and explanation
Correct answer: B
Explanation
The best answer is SSH over TCP port 22. In a real environment, administrators needing secure remote shell access should use SSH because it provides encrypted management sessions, server/client authentication options, and integrity protection. TCP is the correct transport because an interactive administrative session depends on reliable, ordered delivery. Telnet is insecure because it sends data in cleartext. SFTP, while secure, is for file transfer rather than terminal administration. SNMPv3 is appropriate for monitoring and some management tasks, but not for full remote shell access. This aligns with common security best practices and vendor guidance, including the use of SSH for secure administration and the deprecation of Telnet for administrative access.
- A. Incorrect.
This is incorrect. Telnet uses TCP port 23 and does provide remote terminal access, but it does not encrypt session data or credentials. Using Telnet on an untrusted network would expose administrator commands and usernames/passwords to interception. A candidate might choose this option because Telnet is historically associated with command-line remote access, but it does not meet modern security requirements.
- B. Correct.
This is correct. SSH is the standard secure protocol for encrypted remote command-line administration of Linux and other UNIX-like systems. It commonly uses TCP port 22, and TCP is appropriate because remote administration requires reliable, ordered delivery of session data. This option correctly aligns protocol selection, port selection, and transport method with the stated requirement.
- C. Incorrect.
This is incorrect. SFTP is related to SSH and typically runs over SSH using TCP port 22, not UDP. More importantly, SFTP is intended for secure file transfer rather than interactive command-line administration. Someone might pick this option because SFTP is secure and associated with port 22, but it does not directly satisfy the requirement for remote shell administration as stated.
- D. Incorrect.
This is incorrect. SNMPv3 improves security over earlier SNMP versions by supporting authentication and encryption, and it commonly uses UDP port 161 for polling. However, SNMPv3 is designed for network monitoring and management, not interactive command-line administration of Linux servers. This distractor is plausible because it is a secure management protocol, but it is the wrong tool for shell access.